SOX Risk and Control Matrix Template for ICFR
Keeps internal control over financial reporting in one workbook: a risk and control matrix (risk, assertion, control, owner, frequency, key / non-key, evidence, IPE), a testing log with sample sizes, a deficiency tracker with severity and remediation, and a dashboard that rolls it up for management's assessment and the 302 / 906 certifications.
Tab structure
- Instructions
- Setup – fiscal year start and end, roll-forward and remediation lead times, sample-size table (your auditor's or your own methodology), assessment note and tracker review block
- Dashboard – controls in scope, key controls, tested, effective, exceptions, open deficiencies by severity, overdue remediation, and one overall status line
- Risk & Control Matrix – risk and what could go wrong, assertion, risk rating, control description (who, what, when, precision, follow-up), type, nature, frequency, key, ICFR / DC&P, owner, evidence, reports / IPE relied on, FS caption, linked workpaper; latest test result for the current year and open deficiency pulled in automatically
- Testing – test ID, control, test type, dates and period covered, required vs tested sample, exceptions, result, tester and reviewer
- Deficiencies – description, severity, aggregation, compensating controls, root cause, remediation plan, owner, target and retest dates, audit committee reporting, and the disclosure / certification consequence
- Lists
Key checks and flags
- Key controls without a current-year test, and controls tested Ineffective, are counted on the Dashboard
- Sample tested below the required sample, exceptions with an Effective result, or a missing reviewer are flagged on the test row
- Control IDs on the Testing and Deficiencies tabs must exist in the matrix
- Material weaknesses show the consequence for Item 9A / Item 4 and the 302 certification (S-K 307, 308); significant deficiencies prompt audit committee reporting
- Remediation targets past due, or too close to year-end for the remediated control to operate, are flagged
- Closed deficiencies need a retest date; aggregation must be considered
Who uses it
The SOX lead, controller and SEC reporting manager who maintain the control matrix and report ICFR status to the disclosure committee, auditors and audit committee.
Primary sources
Previews
Rendered from the actual workbook with illustrative sample data ("Example Company, Inc.", period end December 31, 2026). Scroll sideways on small screens.
Dashboard
Dashboard tab: control, testing and deficiency counts with one overall status line.
Risk & Control Matrix
Risk & Control Matrix tab: risks, controls, owners, frequency, key controls and latest results.